Index: lams_tool_larsrc/web/WEB-INF/web.xml
===================================================================
diff -u -rfdb3e5c043522549d839142cfb3ef4e919913bbd -r574fe22e4c26a90598f39e06edbc18dc308f82a4
--- lams_tool_larsrc/web/WEB-INF/web.xml	(.../web.xml)	(revision fdb3e5c043522549d839142cfb3ef4e919913bbd)
+++ lams_tool_larsrc/web/WEB-INF/web.xml	(.../web.xml)	(revision 574fe22e4c26a90598f39e06edbc18dc308f82a4)
@@ -131,38 +131,23 @@
   <servlet-mapping>
 	<servlet-name>action</servlet-name>
     <url-pattern>*.do</url-pattern>
-</servlet-mapping>
+	</servlet-mapping>
+	
+	<servlet-mapping>
+	    <servlet-name>Connector</servlet-name>
+	    <url-pattern>/editor/filemanager/browser/default/connectors/jsp/connector</url-pattern>
+	</servlet-mapping>
+	
+	<servlet-mapping>
+		<servlet-name>download</servlet-name>
+		<url-pattern>/download/*</url-pattern>
+	</servlet-mapping>
 
-<servlet-mapping>
-    <servlet-name>Connector</servlet-name>
-    <url-pattern>/editor/filemanager/browser/default/connectors/jsp/connector</url-pattern>
-</servlet-mapping>
+	<servlet-mapping>
+		<servlet-name>exportPortfolio</servlet-name>
+		<url-pattern>/exportPortfolio</url-pattern>
+	</servlet-mapping>
 
-<servlet-mapping>
-	<servlet-name>download</servlet-name>
-	<url-pattern>/download/*</url-pattern>
-</servlet-mapping>
-
-<servlet-mapping>
-	<servlet-name>exportPortfolio</servlet-name>
-	<url-pattern>/exportPortfolio</url-pattern>
-</servlet-mapping>
-
-   <session-config>
-      <session-timeout>120</session-timeout>
-   </session-config>
-
-   <!--
-   To specify mime mappings, create a file named mime-mappings.xml, put it in your project's mergedir.
-   Organize mime-mappings.xml following this DTD slice:
-
-   <!ELEMENT mime-mapping (extension, mime-type)>
-   -->
-
-  <error-page>
-	<error-code>403</error-code>
-	<location>/403.html</location>
- </error-page>
   	<jsp-config>
 		<!--  ======================================================== -->	
 		<!-- Struts Tag Library Descriptors -->
@@ -219,4 +204,137 @@
 
 	</jsp-config>
 
+   	<!--  Security Constraint -->
+	<security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>Secure Content</web-resource-name>
+			<url-pattern>/*</url-pattern>
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>LEARNER</role-name>
+    		<role-name>TEACHER</role-name>
+    		<role-name>STAFF</role-name>
+    		<role-name>AUTHOR</role-name>
+    		<role-name>ADMIN</role-name>
+    		<role-name>SYSADMIN</role-name>
+    	</auth-constraint>
+    </security-constraint>
+
+    <security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>Authoring Update</web-resource-name>
+		    <url-pattern>/authoring.do</url-pattern>
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>AUTHOR</role-name>
+    	</auth-constraint>
+    </security-constraint>
+    <security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>Staff Content</web-resource-name>
+		    <url-pattern>/monitoring.do</url-pattern>
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>STAFF</role-name>
+    		<role-name>TEACHER</role-name>
+    	</auth-constraint>
+    </security-constraint>
+    <security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>Staff Content</web-resource-name>
+		    <url-pattern>/definelater.do</url-pattern>
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>STAFF</role-name>
+    		<role-name>TEACHER</role-name>
+    	</auth-constraint>
+    </security-constraint>
+
+    <security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>Adminstrator Content</web-resource-name>
+		    <url-pattern>/admin.do</url-pattern> 
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>ADMIN</role-name>
+    	</auth-constraint>
+    </security-constraint>
+    <security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>LAMS System Adminstrator Content</web-resource-name>
+		    <url-pattern>/sysadmin.do</url-pattern> 
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>SYSADMIN</role-name>
+    	</auth-constraint>
+    </security-constraint>
+	<!--  some combine role security setting -->
+    <security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>Download Files</web-resource-name>
+		    <url-pattern>/download/</url-pattern>
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>AUTHOR</role-name>
+    		<role-name>STAFF</role-name>
+    		<role-name>TEACHER</role-name>
+    		<role-name>ADMIN</role-name>
+    		<role-name>SYSADMIN</role-name>
+    	</auth-constraint>
+    </security-constraint>
+
+  <!-- ======================================================== -->
+	<!--  Security Roles -->
+    <!-- ======================================================== -->
+	<security-role>
+		<description>Student</description>
+		<role-name>LEARNER</role-name>
+	</security-role>
+	<security-role>
+		<description>Student</description>
+		<role-name>TEACHER</role-name>
+	</security-role>
+
+	<security-role>
+		<description>Can create/modify a learning design</description>
+		<role-name>AUTHOR</role-name>
+	</security-role>
+
+	<security-role>
+		<description>Can running and monitoring a learning session</description>
+		<role-name>STAFF</role-name>
+	</security-role>
+
+	<security-role>
+		<description>Can add/remove users to the system, set up classes of users for sessions</description>
+		<role-name>ADMIN</role-name>
+	</security-role>
+
+	<security-role>
+		<description>Can add/remove users to the system, set up classes of users for sessions</description>
+		<role-name>SYSADMIN</role-name>
+	</security-role>
+	<!--  Login Configuration -->
+  	<login-config>
+   		<auth-method>FORM</auth-method>
+		<realm-name>LAMS</realm-name>
+   		<form-login-config>
+    		<form-login-page>/login.jsp</form-login-page>
+			<form-error-page>/login.jsp?failed=y</form-error-page>    		
+   		</form-login-config>
+   	</login-config>
+   	
+    <error-page>
+        <error-code>500</error-code>
+        <location>/error.jsp</location>
+    </error-page>
+    <error-page>
+        <error-code>403</error-code>
+        <location>/403.jsp</location>
+    </error-page>
+    <error-page>
+        <error-code>404</error-code>
+        <location>/404.jsp</location>
+    </error-page>
+    
 </web-app>